---
id: "CVE-2026-120839"
page: "https://infrastack.ai/live/CVE-2026-120839"
kind: "vulnerability"
aliases: ["CVE-2026-120839"]
title: "WpTravelly WordPress plugin: file inclusion flaw lets attackers read or run local PHP files"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "tour-booking-manager", "wordpress", "wptravelly"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-07T13:16:34+00:00"
first_seen_at: "2026-11-07T13:47:25+00:00"
updated_at: "2026-11-07T13:49:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120839", "first_seen_at": "2026-11-07T13:47:25+00:00"}]
exploit_sources: []
---

# WpTravelly WordPress plugin: file inclusion flaw lets attackers read or run local PHP files

Link for people: https://infrastack.ai/live/CVE-2026-120839 (this .md is for agents)

The WpTravelly tour-booking WordPress plugin builds a file path for PHP include/require from input an attacker can influence, so it loads files it should not. An attacker can read or execute local PHP files on the site, with the impact of an NVD CVSS 8.8 rating.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WpTravelly (tour-booking-manager) plugin is installed and its version, in the WordPress admin under Plugins, or with `wp plugin get tour-booking-manager --field=version` if WP-CLI is available.
- Compare the installed version against the affected range: all versions through `2.3.8`.

## Fix

- WpTravelly (tour-booking-manager): the sources give no fixed version; the affected range is through `2.3.8`.

## Timeline

- 2026-11-07T13:47:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120839

## From the sources

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_